Executive brief
Microsoft PowerPoint is a widely used presentation application. A vulnerability in how it handles specific internal data structures allows an attacker to take full control of a computer if a user opens a specially crafted PowerPoint file. This flaw has been actively exploited in the wild to install malicious software, potentially leading to data theft or complete system compromise.
Technical details
A memory corruption vulnerability exists in Microsoft PowerPoint due to improper validation of index values within the OutlineTextRefAtom structure. By crafting a malicious PowerPoint file with an invalid index, a remote attacker can trigger a heap-based memory corruption or code injection (CWE-94). Exploitation requires a user to open the malicious file, typically delivered via email or a malicious website. Successful exploitation allows for arbitrary code execution in the context of the logged-in user. This vulnerability was notably exploited in the wild by the 'Apptom' malware family. Microsoft has released security bulletin MS09-017 to address this issue.
Affected products
- Microsoft PowerPoint 2000 SP3
- Microsoft PowerPoint 2002 SP3
- Microsoft PowerPoint 2003 SP3
- Microsoft Office 2004 for Mac PowerPoint component
Timeline
- 2009-04-02: exploited: Exploitation in the wild reported by Microsoft and security researchers.
- 2009-06-09: patched: Microsoft released security bulletin MS09-017.
- 2026-01-07: kev added: Added to CISA Known Exploited Vulnerabilities catalog.